summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-12pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev()Karl Mehltretter
mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, the condition dereferences a stale or invalid pointer, potentially faulting or incorrectly skipping the first OPP. Initialize prev_o to NULL. This matches the intent as well: there is no previous OPP to compare against on the first iteration. Found with Clang's -Wconditional-uninitialized. Fixes: f08e7a4e8d6ac ("pmdomain: mediatek: Add support for MFlexGraphics") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Reviewed-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-12pmdomain: renesas: Add R-Car X5H MDLC driverGeert Uytterhoeven
Add a minimal Module Controller driver for the R-Car X5H (R8A78000) SoC. For now this just supports the always-on power domains, and dummy module clocks and resets for the serial console (which is enabled by the boot loader). Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-12dt-bindings: mfd: syscon: Add ESWIN EIC7700 compatiblePinkesh Vaghela
Document ESWIN EIC7700 SoC compatible for syscon registers. Signed-off-by: Pinkesh Vaghela <pinkesh.vaghela@einfochips.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260804104431.1391839-5-pinkesh.vaghela@einfochips.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12mfd: qnap-mcu: keep the reply buffer alive past a command timeoutAli Ahmet Memis
qnap_mcu_exec() publishes an on-stack buffer to the receive path: unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE]; ... reply->data = rx; reply->length = length; and qnap_mcu_receive_buf() writes into it from the serdev receive path, which runs out of flush_to_ldisc() and is not serialized against qnap_mcu_exec() at all. bus_lock cannot cover it, because qnap_mcu_exec() holds that mutex across wait_for_completion_timeout(). On a timeout qnap_mcu_exec() returns with reply->data still pointing at its own frame. A reply that arrives late, or an unsolicited message from the MCU, is then written into a stack frame that has been left, corrupting whatever runs next on that stack. The same applies when qnap_mcu_write() fails, since that path returns without touching the reply state either. Move the receive buffer into struct qnap_mcu. It is 37 bytes and the structure is devm_kzalloc()ed, so it lives as long as the driver, and a late write lands in memory that is still valid and is reinitialized by the next command. bus_lock keeps commands from sharing it. This deliberately does not clear reply->data or reply->length on the timeout path. Doing so races with qnap_mcu_receive_buf(), which reads both after its if (!reply->length) return size; check: clearing reply->data gives a NULL dereference, and clearing reply->length alone removes the reply->received == reply->length exit condition, so the copy loop runs until the uart chunk is consumed and overruns the buffer. Leaving both set keeps the write bounded by reply->length, which qnap_mcu_exec() has already checked against sizeof(mcu->rx). Fixes: 998f70d1806b ("mfd: Add base driver for qnap-mcu devices") Cc: stable@vger.kernel.org Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com> Link: https://lore.kernel.org/all/20260802132012.537B81F000E9@smtp.kernel.org/ Link: https://patch.msgid.link/20260802135307.31380-1-ali@iusegentoo.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12rust: module: update MAINTAINERS to cover module.rsAlvin Sun
Module types now live in `rust/kernel/module.rs` alongside `rust/kernel/module_param.rs`. Update the MODULE SUPPORT file pattern from `rust/kernel/module_param.rs` to `rust/kernel/module*.rs` so both files are covered. Assisted-by: opencode:glm-5.2 Link: https://lore.kernel.org/rust-for-linux/8ea21b29-9baf-4926-a16f-7d21c5a1a1b8@suse.com Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-10-7e71776f9dbe@linux.dev [ Removed Acked-by and Cc. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: macros: remove `THIS_MODULE` static from `module!`Alvin Sun
All users have been migrated to `ModuleMetadata::THIS_MODULE` const or `this_module::<LocalModule>()` helper. The `static THIS_MODULE` generated by the `module!` macro is no longer referenced anywhere, so remove it to avoid having two sources of the same `ThisModule` pointer. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-9-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust_binder: use `LocalModule` for `THIS_MODULE`Alvin Sun
Replace the `THIS_MODULE` static reference in the binder fops with `this_module::<LocalModule>()`, consistent with the move of `THIS_MODULE` into the `ModuleMetadata` trait. Assisted-by: opencode:glm-5.2 Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-8-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: configfs: use `LocalModule` for `THIS_MODULE`Alvin Sun
Replace the `THIS_MODULE` static reference in the `configfs_attrs!` macro with `this_module::<LocalModule>()`, and update rnull to import `LocalModule` instead of `THIS_MODULE`, consistent with the move of `THIS_MODULE` into the `ModuleMetadata` trait. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-7-7e71776f9dbe@linux.dev [ Rebased to avoid the imports cleanup patch. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: miscdevice: set fops.owner from driver module pointerAlvin Sun
Set the miscdevice fops owner field from the driver module pointer via the `this_module::<T::OwnerModule>()` helper, instead of defaulting to null. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-6-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: drm: set fops.owner from driver module pointerAlvin Sun
Change `create_fops()` to accept an owner module pointer instead of hardcoding `null_mut()`, ensuring the kernel correctly tracks the module owning the DRM device's file operations. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-5-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: macros: auto-insert OwnerModule in #[vtable]Alvin Sun
Auto-add `type OwnerModule: ::kernel::ModuleMetadata;` as a required associated type on the trait side if not already defined, and auto-insert `type OwnerModule = crate::LocalModule;` on the impl side if not explicitly provided, eliminating the need to manually declare and implement `OwnerModule` in every vtable trait and impl. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Suggested-by: Gary Guo <gary@garyguo.net> Link: https://lore.kernel.org/all/DIMMWHUOLPSH.13JFRHDKDQJGO@garyguo.net Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-4-7e71776f9dbe@linux.dev [ Fixed `rusttest` by adding a dummy `LocalModule`. Removed interim `#[allow(dead_code)]`. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: doctest: add LocalModule fallback for #[vtable] ThisModuleAlvin Sun
Add a `LocalModule` struct with a null-pointer `ModuleMetadata` impl in the doctest harness, so that `crate::LocalModule` (auto-inserted by `#[vtable]`) resolves correctly when there is no `module!` macro. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-3-7e71776f9dbe@linux.dev [ Fixed `clippy::undocumented_unsafe_blocks` lint by wrapping with a block. Added interim `#[allow(dead_code)]`. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: module: add `THIS_MODULE` const to `ModuleMetadata` traitAlvin Sun
Since `const_refs_to_static` has been stable as of the MSRV bump, a `ThisModule` pointer can now be used in const contexts. Add a `THIS_MODULE` const to the `ModuleMetadata` trait so that modules can provide their `ThisModule` pointer in const contexts such as static `file_operations`. Add a `this_module()` helper to retrieve the `THIS_MODULE` pointer of a given module type, and update `__init` to use it instead of the `THIS_MODULE` static generated by the `module!` macro. The `static THIS_MODULE` generated by the `module!` macro is retained for backwards compatibility with existing users and removed in a later patch once all references have been migrated. Assisted-by: opencode:glm-5.2 Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-2-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12rust: module: move module types into `module.rs`Alvin Sun
Move `Module`, `InPlaceModule`, `ModuleMetadata` and `ThisModule` from `lib.rs` into a new `rust/kernel/module.rs`. Re-export them from `lib.rs` to avoid tree-wide changes. Switch six bus driver registrations from `module.0` to the public `ThisModule::as_ptr()` accessor, since the field is no longer visible outside the new `module` submodule. No functional change. Assisted-by: opencode:glm-5.2 Suggested-by: Gary Guo <gary@garyguo.net> Link: https://lore.kernel.org/all/DJFIQPLOVO4T.1K8T0VZM30LDA@garyguo.net/ Reviewed-by: Gary Guo <gary@garyguo.net> Acked-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Acked-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Alvin Sun <alvin.sun@linux.dev> Link: https://patch.msgid.link/20260811-fix-fops-owner-v10-1-7e71776f9dbe@linux.dev Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-12Merge patch series "fixes for iomap_bio_read_folio_range_sync"Christian Brauner
Christoph Hellwig <hch@lst.de> says: Two fixes for iomap_bio_read_folio_range_sync, a potential kernel crash when tweaking the device integrity behvavior using sysfs, and a missing bio_uninit that the Sashiko review of the first fix found. * patches from https://patch.msgid.link/20260804124404.737145-1-hch@lst.de: iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninit iomap: don't free integrity payload that doesn't exist Link: https://patch.msgid.link/20260804124404.737145-1-hch@lst.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12iomap: iomap_bio_read_folio_range_sync is missing a call to bio_uninitChristoph Hellwig
Which could leak blkg references. Fixes: c03cea42149d ("iomap: add initial support for writes without buffer heads") Signed-off-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260804124404.737145-3-hch@lst.de Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12iomap: don't free integrity payload that doesn't existChristoph Hellwig
fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device. Check for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereferences. Make the branch cover the PI verification as well - while fs_bio_integrity_verify works without an integrity payload, it requires one to actually do useful work. Fixes: 0b10a370529c ("iomap: support T10 protection information") Cc: stable@vger.kernel.org # v7.1 Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Anuj Gupta <anuj20.g@samsung.com> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Reviewed-by: "Darrick J. Wong" <djwong@kernel.org> Link: https://patch.msgid.link/20260804124404.737145-2-hch@lst.de Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12super: fix dying superblock warning messagesKarl Mehltretter
WARN_ON_ONCE() takes a condition, not a message. The string literals are always true, so the warnings still trigger but the messages are never printed. Use WARN_ONCE(1, ...) instead to print the messages and keep the once-only behavior. Found with a Coccinelle script. Clang's -Wstring-conversion also flags such calls but is not enabled in kernel builds. Fixes: f0cd988016f6 ("fs: massage locking helpers") Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260808123802.73687-1-kmehltretter@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-12docs: fix grammatical error in iomap docsBenjamin Wu
Change "This origins" -> "The origins" Signed-off-by: Benjamin Wu <benjamin.wu37@gmail.com> Link: https://patch.msgid.link/20260810063704.355933-1-benjamin.wu37@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-11Merge tag 'sunxi-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: Some cleanups to the Allwinner clock driver library and support for the Allwinner A733 RTC clocks added. * tag 'sunxi-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: sun6i-rtc: add a733 support clk: sunxi-ng: sun6i-rtc: split main oscillator div and gate clk: sunxi-ng: div: add read-only operation support clk: sunxi-ng: mux: fix determine helper rate propagation clk: sunxi-ng: mux: remove unneeded export clk: sunxi-ng: sun6i-rtc: Add feature bit for IOSC calibration clk: sunxi-ng: sun6i-rtc: clean up DT usage clk: sunxi-ng: fix ccu probe clock unregister on error dt-bindings: rtc: sun6i: add sun60i-a733 support dt-bindings: rtc: sun6i: no clock-output-names on h616/r329
2026-08-11Merge tag 'qcom-clk-for-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: Add global, TCSR, RPMh, and video clock controller support for Maili. Add global, RPM, GPU, display, and audio core clock controller support for Shikra. Add display and graphics clock controllers for Nord. Add Glymur camera and EVA clock controllers, the IPQ9650 REFGEN clocks, and Hawi video clock controller support. Extend the IPQ5210 APSS PLL and RPM clock support for Agatti. Enable runtime PM and regulator-backed reference clock handling where needed. Update QCM2290 clock and power-domain handling, critical clock definitions, and arm architecture Kconfig defaults. Correct MDM9607, MSM8916, MSM8939, SM6115, QCS8300, Kaanapali, and Glymur clock and power-domain handling. Improve GDSC error propagation and teardown. Update bindings for the added controllers and required power and OPP properties. * tag 'qcom-clk-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (94 commits) clk: qcom: Add support for Qualcomm GPU Clock Controller on Shikra clk: qcom: Return expected ENOMEM error on dynamic allocation failure clk: qcom: apss-ipq-pll: Add IPQ5210 support dt-bindings: clock: qcom,a53pll: Add IPQ5210 compatible clk: qcom: Add support for videocc driver on Qualcomm Maili SoC dt-bindings: clock: qcom: Add Qualcomm Maili video clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra GPU clock controller dt-bindings: clock: qcom: Add Qualcomm Shikra Display clock controller clk: qcom: gpucc-qcm2290: Park RCG's clk source at XO during disable clk: qcom: gpucc-qcm2290: Keep the critical clocks always-on from probe clk: qcom: gpucc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gpucc-qcm2290: Drop pm_clk handling clk: qcom: qcm2290: Update DISPCC and GPUCC GDSC *wait_val values clk: qcom: qcm2290: Add RETAIN_FF_ENABLE flag for DISPCC and GPUCC GDSCs clk: qcom: qcm2290: Set POLL_CFG_GDSCR flag for DISPCC and GPUCC GDSCs clk: qcom: dispcc-qcm2290: Enable runtime PM support clk: qcom: dispcc-qcm2290: Move to the latest common qcom_cc_probe() model clk: qcom: gcc-qcm2290: Keep the critical clocks always-on from probe dt-bindings: clock: qcom,qcm2290-dispcc: Add missing power-domains property clk: qcom: Add Audio Core clock controller support on Qualcomm Shikra SoC ...
2026-08-11Merge tag 'samsung-clk-7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clk driver updates from Krzysztof Kozlowski: - Exynos990: Add few missing clocks and correct the gate clock parents in the PERIS clock controller. - Cleanup - Use kzalloc_flex for __counted_by checks in Samsung clk driver. * tag 'samsung-clk-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: pll: use kzalloc_flex clk: samsung: cpu: use kzalloc_flex clk: samsung: use kzalloc_flex clk: samsung: exynos990: Fix PERIS gate clock parents clk: samsung: exynos990: Add PERIS TMU_SUB_PCLK gate dt-bindings: clock: exynos990: Add CLK_GOUT_PERIS_TMU_SUB_PCLK
2026-08-11Merge tag 'v7.3-rockchip-clk1' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull Rockchip clk driver updates from Heiko Stuebner: - Clock driver for Rockchip RV1106 - Fix for Rockchip rk3576 spi source mux - Better representing fractional PLL coefficients in Rockchip clk driver - Fix for the Rockchip dclk of the 3rd video-port to not affect other compoents when its rate gets changed * tag 'v7.3-rockchip-clk1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3576: fix source muxes for SPI0..SPI4 clk: rockchip: Add clock controller for the RV1106 dt-bindings: clock: rockchip: Add RV1106 CRU support clk: rockchip: Fractional PLL coefficient on RK3588/RK3576 is two's complement clk: rockchip: Fix the fractional part denominator on RK3588/RK3576 PLLs clk: rockchip: rk3588: Allow VP2 the same sourcing options as other VPs clk: rockchip: rk3588: Don't change PLL rates when setting dclk_vop2_src
2026-08-12clk: at91: Read "reg" with helperRob Herring (Arm)
The "reg" property is an address-sized DT cell property. The AT91 compat clock parser only uses a small bus id from it, but reading it with the u8 helper does not match the property encoding. Use of_property_read_reg() so the code goes through the helper for "reg" properties, then keep the existing range check before passing the bus id to the clock registration code. Assisted-by: Codex:gpt-5-5 Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Reviewed-by: Brian Masney <bmasney@redhat.com> Link: https://patch.msgid.link/20260612215251.1888345-1-robh@kernel.org Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
2026-08-11Merge tag 'clk-imx-7.3' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clk driver updates from Abel Vesa: - Add audio PLL debugfs support for K-divider control. - Add missing MODULE_DEVICE_TABLE() declarations for i.MX8QXP clock drivers. - Add PCIe FUNC_OUTPUT_EN clock gate support on i.MX95. - Configure the i.MX95 PCIe transmitter current reference to fix REFCLK rise-fall timing. * tag 'clk-imx-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: clk: imx95-blk-ctl: Fix REFCLK rise-fall mismatch on i.MX95 clk: imx95-blk-ctl: Add func_out_en clock for i.MX9x PCIe clk: imx: imx8qxp: add missing MODULE_DEVICE_TABLE() clk: imx: imx8qxp-lpcg: add missing MODULE_DEVICE_TABLE() clk: imx: Add audio PLL debugfs for K-divider control
2026-08-12ALSA: hda/ca0132: replace sprintf() with snprintf()Bob Song
Replace six sprintf() calls that write to SNDRV_CTL_ELEM_ID_NAME_MAXLEN-sized buffers with snprintf() to avoid potential buffer overflows. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260812033030.635417-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12ALSA: hda/ca0132: set codec->spec to NULL after freeingBob Song
ca0132_free() and dbpro_free() call kfree(codec->spec) without setting codec->spec to NULL afterward, leaving a dangling pointer. Set it to NULL. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260812033019.635010-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12ALSA: hda: simplify match functions and remove unreachable returnBob Song
hda_bus_match() has an unreachable 'return 1' after an if/else that covers both branches. Remove the superfluous return and simplify the control flow by dropping the else branch. hdac_codec_match() uses a redundant if/else to return 1 or 0. Simplify to a single return statement. Signed-off-by: Bob Song <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260812033007.633564-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-12ALSA: usb-audio: Fix sample rates for PreSonus AudioBox USBTrevor Vorhees
The fixed audio formats for the PreSonus AudioBox USB specify a discrete rate mask but leave nr_rates at zero and rate_table unset. find_format() therefore rejects every requested rate, preventing the playback and capture streams from being opened. Add the advertised 44100 and 48000 Hz rates to both streams and report their 24 significant bits. Fixes: 34fe4a9df247 ("ALSA: usb-audio: Add quirk for PreSonus AudioBox USB") Cc: stable@vger.kernel.org Signed-off-by: Trevor Vorhees <vorhees-work@proton.me> Link: https://patch.msgid.link/20260811-audiobox-usb-fix-v1-1-13c8b7f071ea@proton.me Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-11Merge tag 'spacemit-clk-for-7.3-1' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into clk-spacemit Pull RISC-V SpacemiT clk driver updates from Yixun Lan: - Add clock for SpacemiT UFS controller - Add SpacemiT I2S clock and fixes * tag 'spacemit-clk-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: clk: spacemit: k3: fix missing /2 factor in i2s sysclk dividers clk: spacemit: k3: fix i2s clock topology dt-bindings: soc: spacemit: k3: add i2s_sysclk, i2s_bclk_factor and i2s1_sysclk_src IDs clk: spacemit: k3: Add UFS refclk clock dt-bindings: soc: spacemit: k3: Add clock ID for UFS refclk clk: spacemit: k3: fix parent clock of UFS aclk
2026-08-11Merge tag 'clk-meson-v7.3-1' of ssh://github.com/BayLibre/clk-meson into ↵Stephen Boyd
clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Fix the incorrect parent number of the 32k clock on Amlogic GXBB - Add the AO and peripheral clock controllers for the new Amlogic A9 chip * tag 'clk-meson-v7.3-1' of ssh://github.com/BayLibre/clk-meson: clk: amlogic: Add A9 peripherals clock controller driver dt-bindings: clock: Add Amlogic A9 peripherals clock controller clk: amlogic: Add A9 AO clock controller driver dt-bindings: clock: Add Amlogic A9 AO clock controller clk: meson: align gxbb_32k_clk_sel number of parents with actual count
2026-08-11Merge tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux into ↵Stephen Boyd
clk-mobileye Pull Mobileye clk driver updates from Benoît Monin: - Add support for Mobileye EyeQ7H This patchset brings the support of the Other Logic Blocks (OLB) found in the first Mobileye SoC based on the RISC-V architecture, the EyeQ7H. Despite the change from MIPS to RISC-V, the Other Logic Blocks provide similar clock and reset functions to the controllers of the chip. This series introduces the device tree bindings of the SoC and the necessary changes to the clock and reset eyeq drivers. Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> * tag 'clk-eyeq7h-7.3' of ssh://github.com/benoitmonin/linux: clk: eyeq: Add EyeQ7H compatibles clk: eyeq: Drop PLL, dividers, and fixed factors structs clk: eyeq: Convert clocks declaration to eqc_clock clk: eyeq: Introduce a generic clock type clk: eyeq: Prefix the PLL registers with the PLL type clk: fixed-factor: Export __clk_hw_register_fixed_factor() clk: fixed-factor: Rework initialization with parent clocks reset: eyeq: Add EyeQ7H compatibles dt-bindings: soc: mobileye: Add EyeQ7H OLB
2026-08-11Merge tag 'thead-clk-for-v7.3' of ↵Stephen Boyd
https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead Pull one T-HEAD clk driver update from Drew Fustini: There is just one change for this cycle. It allows COMPILE_TEST to select the th1520 clk driver without having CONFIG_ARCH_THEAD enabled. * tag 'thead-clk-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: clk: thead: allow COMPILE_TEST builds
2026-08-11Merge tag 'renesas-clk-for-v7.3-tag2' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull more Renesas clk driver updates from Geert Uytterhoeven: - Add initial support for the R-Car X5H (R8A78000) SoC * tag 'renesas-clk-for-v7.3-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: Add R-Car X5H CPG driver dt-bindings: clock: Document Renesas R-Car X5H Clock Pulse Generator
2026-08-11Merge tag 'renesas-clk-for-v7.3-tag1' of ↵Stephen Boyd
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add RTC and display clocks on RZ/T2H and RZ/N2H - Add audio and display clocks and resets on RZ/G3E - Add SDHI, GPU, and USB2.0 clocks and resets on RZ/G3L - Update the maintainer for the VersaClock 7 driver - Add CAN-FD clocks and resets for RZ/G3S * tag 'renesas-clk-for-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: r9a08g045: Add clocks and resets for CAN-FD dt-bindings: clock: renesas,versaclock7: Update maintainer clk: renesas: r9a09g047: Add LVDS clocks and resets clk: renesas: r9a09g077: Add LCDC and PLL3 clock support for RZ/T2H display pipeline clk: renesas: rzv2h-cpg: Extract PLL calculation helpers into shared library clk: renesas: rzv2h-cpg: Use per-SoC PLL reference frequency for calculations clk: renesas: r9a08g046: Add USB2.0 clock and reset entries clk: renesas: r9a09g077: Add RTC clocks clk: renesas: cpg-mssr: Implement dedicated MSTP delay logic for RZ/T2H LCDC and RTC clk: renesas: r9a08g046: Add clock and reset entries for GE3D clk: renesas: r9a08g046: Add clock and reset entries for SDHI clk: renesas: r9a09g047: Add audio clock and reset support dt-bindings: clock: renesas: Add audio clock inputs for RZ/V2H family dt-bindings: clock: renesas,r9a09g077/87: Add PCLKRTC clock ID dt-bindings: clock: renesas,r9a09g077/87: Add LCDC_CLKD clock ID
2026-08-11PCI/ASPM: Use pcie_capability_clear_and_set_word() for ASPM disable/restoreKrishna Chaitanya Chundru
pcie_aspm_cap_init() disables ASPM L0s/L1 on both ends of the Link before touching L1SS config, then later restores the LNKCTL state that was in effect beforehand. Both steps use raw pcie_capability_write_word() calls: the disable step computes the new value by hand from a snapshot taken earlier in the function, and the restore step writes that same snapshot straight back. Switch both steps to pcie_capability_clear_and_set_word(), masked to PCI_EXP_LNKCTL_ASPMC, matching the accessor pcie_config_aspm_dev() already uses elsewhere in this file for the exact same register. This does a live read-modify-write of just the ASPM Control bits instead of relying on a stale snapshot for the rest of the word, and is consistent with how the rest of the file already touches this register. No functional change. Fixes: 7447990137bf ("PCI/ASPM: Disable L1 before disabling L1 PM Substates") Closes: https://lore.kernel.org/all/20260721143945.86E7D1F000E9@smtp.kernel.org/ Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Manivannan Sadhasivam <mani@kernel.org> Link: https://patch.msgid.link/20260727-aspm-v6-1-2ebb3ee7ef71@oss.qualcomm.com
2026-08-11cgroup/cpuset: Add test for partition root invalidation returning wrong CPUsShaojie Sun
Add a test case to REMOTE_TEST_MATRIX covering the bug fixed by commit 345f40166694 ("cgroup/cpuset: Return only actually allocated CPUs during partition invalidation"). The test verifies that when a sibling partition root changes its cpuset.cpus to overlap with another partition root, only actually allocated CPUs (effective_xcpus) are returned to the parent, not all CPUs in cpus_allowed. Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn> Reviewed-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flagGuopeng Zhang
Commit 16a1d968358a ("mm/slab: remove mm/slab.c and slab_def.h") removed the SLAB allocator, the only allocator that implemented cpuset slab spreading. Commit 61a182ab61a6 ("cgroup/cpuset: Remove cpuset_do_slab_mem_spread()") then removed the last task_spread_slab() caller. Commit 3ab67a9ce82f ("cgroup/cpuset: Mark memory_spread_slab as obsolete") marked the legacy control obsolete. cpuset still updates PFA_SPREAD_SLAB when tasks attach to a legacy cpuset and walks all tasks in a cpuset when memory_spread_slab changes. Remove the unused task flag and its helpers, and make spread task updates depend only on memory_spread_page. Keep the memory_spread_slab control and CS_SPREAD_SLAB state so legacy users retain the existing write, readback and inheritance behavior. Update the comments and documentation to describe only page-cache spreading as functional. Assisted-by: LLM Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn> Reviewed-by: Waiman Long <longman@redhat.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11Merge branch 'mptcp-out-of-order-queue-pruning'Jakub Kicinski
Matthieu Baerts says: ==================== mptcp: out-of-order queue pruning Under memory pressure, a pruning of the MPTCP-level OoO queue might be required as last resort, to avoid too long recoveries, or even stalls. Geliang and Gang managed to reproduce this behaviour, and Paolo improved the situation thanks to the following patches: - Patches 1-3: improve the MPTCP-level retransmission schema to make recoveries from memory pressure/after MPTCP-level drop significantly faster. - Patches 4-5: make the admission check way stricter for incoming packets exceeding the memory limits, with some exceptions for fallback sockets. - Patches 6-7: implement OoO queue pruning for MPTCP. ==================== Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-0-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: implemented OoO queue pruningPaolo Abeni
When moving incoming skbs in the msk receive queue and the latter is above limits, prune it as needed quite alike what TCP is doing at the subflow level. The main difference relies in the stop condition: since MPTCP does not perform collapsing, it's better off dropping the bare minimum to fit the (newer) incoming packet. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Gang Yan <yangang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-7-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: avoid code duplication in __mptcp_move_skb()Paolo Abeni
Alike TCP, MPTCP handles in-sequence packets and partially overlapping ones in a very similar way: we can use the same path to handle both, avoiding some code duplication. This will also make the next patch simpler. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-6-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: enforce hard limit on backlog flushingPaolo Abeni
Currently a wild producer could keep the backlog flushing operation spinning for an unbound time. Since the previous patch, the amount of data present in the backlog is hard-limited. Move the backlog len update at the end of the flush loop to prevent it spinning forever. Also, no need to splice back the remaining skbs list into the backlog, as such list is always empty after each backlog processing loop. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-5-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: explicitly drop over memory limitsPaolo Abeni
Currently the enforcement of the rcvbuf constraint is implemented when moving the skbs into the msk receive or OoO queue, keeping the incoming skbs in the subflow queue when over limits. Under significant memory pressure the above can cause permanent data transfer stalls, as the skb needed to make forward progress can be stuck in a subflow queue. Over memory limits, drop the incoming skb, relying on MPTCP-level retransmissions. Note that fallback socket must perform the limit before the skb reaches the subflow-level queue, as dropping an in-sequence already acked skb would break the stream. This is not a complete fix for the stall issue, as the drop strategy needs refinements that will come in the next patches. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-4-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: let the retrans scheduler do its jobPaolo Abeni
Currently the MPTCP core enforces that when MPTCP-level retrans timer fires, at most a single dfrag is retransmitted. In some corner-cases, it may be necessary to retransmit multiple dfrags, and the MPTCP socket will need to wait multiple retrans timeout to accomplish that. Remove the mentioned constraint, allowing to transmit multiple dfrags per retrans period, as long as the scheduler keeps selecting subflows for retransmissions and pending data is available in the rtx queue. The default scheduler will transmit a dfrag per available subflow. Tested-by: Gang Yan <yangang@kylinos.cn> Tested-by: Geliang Tang <geliang@kernel.org> Acked-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-3-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: move the stale logic out of retrans schedulerPaolo Abeni
This allow separating the stale logic invocation and the retrans scheduler, and will simplify the next patch. It's also a cleaner design as the retrans scheduler has currently too many side effects. As a possible downside, the retrans work will now traverse the subflows list additional times; that does not matter much, as this is slowpath. While at it, pick more accurate names for the involved helpers and explicitly note that the per subflow stale data is under msk socket lock protection. The scheduler and the stale logic may observe different subflow statues, as no subflow lock is acquired. This is intentional and not harmful, worst case leading to slower retransmissions. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-2-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11mptcp: move the retrans loop to a separate helperPaolo Abeni
This is a cleanup in order to make the next patch simpler. No functional change intended. Tested-by: Gang Yan <yangang@kylinos.cn> Tested-by: Geliang Tang <geliang@kernel.org> Acked-by: Geliang Tang <geliang@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260807-net-next-mptcp-oooq-pruning-v3-1-dbc1eb853cc3@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-11sched_ext: Fix rq->core_pick corruption under core schedulingTejun Heo
Core scheduling's pick_next_task() picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. The selection state is consistent only while the lock is held continuously, so ->pick_task() originally could not release it. However, since 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()"), sched_ext runs dispatch from inside the pick and dispatching can drop the rq lock. To support this, pick_next_task() has been updated to restart the whole selection when a pick returns RETRY_TASK after releasing the lock. When selections on the same core interleave through the dropped lock, they corrupt each other's state: one clears the other's rq->core_pick leading to a NULL deref, or invalidates its keep-the-previous-task decision leaving a dequeued task running, which deadlocks the next wakeup and matches the reported hard hangs. A cookied ping-pong load on an SMT machine makes the interleavings frequent and kills the kernel within seconds. Fix it by making the pick return RETRY_TASK whenever dispatch released the rq lock, so that a selection only ever commits picks made under a continuously held lock. The previous patch's rq->scx.lock_drop_seq counts the releases. A dispatch that touched nothing never releases the lock and its verdict, including "nothing to run", stands: retries are bounded, each following a dispatch that actually did something, and an idle CPU does not loop. If another dispatch is already in flight on the rq, skip dispatching and pick from what is already queued locally - the in-flight dispatch has released the lock, so its own selection will retry and re-pick this rq, while returning RETRY_TASK here would only spin on the lock that dispatch needs to finish. Balance callbacks must run in the context that queued them, so they can only be queued on the CPU's own rq. When dispatching for another rq, run the deferred work directly instead - that rq may consume all its picks through the core-sched fast path and never queue the callback itself. The put_prev_task_scx() warning about a runnable task being left behind assumed that dispatch ran as part of the very pick that is switching away. That now only holds on the non-core path, so gate it and drop the cookie-match test, which is always true without core scheduling, from its condition. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Reported-by: ElXreno <elxreno@gmail.com> Link: https://github.com/sched-ext/scx/issues/3715 Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched_ext: Count rq lock releases in rq->scx.lock_drop_seqTejun Heo
Under core scheduling, pick_next_task() selects for all SMT siblings under one continuous hold of the shared core-wide rq lock, and sched_ext's dispatch can release that lock from inside the pick. In preparation for making the core-sched pick detect the releases and retry, add rq->scx.lock_drop_seq and bump it at every site that can release an rq lock while a dispatch may be in flight. The counter is only maintained while core scheduling is enabled. No functional changes. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched_ext: Fix this_rq() assumptions in dispatch kfuncsTejun Heo
Under core scheduling, dispatch runs from within the core-wide pick and can target a sibling rq, so ops.dispatch() may execute on a CPU different from the dispatched rq's. Several kfunc paths assumed the two always coincide: - scx_dsq_move() decided whether an rq lock is held by testing this_rq()'s rq flags and lock-danced accordingly. A dispatch for a sibling took the unlocked-context branch and acquired the source rq lock on top of the already held dispatched rq lock which could deadlock. - scx_bpf_sub_dispatch() dispatched this_rq() with its stashed sub_dispatch_prev, which is NULL when dispatching for a sibling. - finish_dispatch(), scx_bpf_dsq_reenq() and scx_bpf_dsq_nr_queued() resolved SCX_DSQ_LOCAL to this CPU's local DSQ rather than the dispatched rq's. The latter two are callable from other rq-locked operations too, where SCX_DSQ_LOCAL now likewise resolves to the op's rq. This changes behavior also without core scheduling, e.g. for ops.enqueue() running a remote wakeup on the waking CPU, and is intended: which CPU happens to execute an operation is incidental, the op's rq is what it is operating on, and the resolution now matches the insert side where SCX_DSQ_LOCAL dispatches land on the task's rq. Use the rq tracked by scx_locked_rq(), which is set to the dispatched rq around ops invocations and NULL in unlocked contexts. Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-11sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict returnTejun Heo
SCX_RQ_BAL_KEEP tells the pick to keep running the previous task, a leftover from when balancing and picking were separate operations. An rq-level flag only works while dispatches and picks pair up one to one, which core scheduling breaks: selections interleave through dispatch's lock drops and a pick can consume a stale flag, keeping a task that has since been dequeued. Fixing core scheduling support requires the decision to travel with the dispatch that made it. Make scx_dispatch_sched() and balance_one() return an explicit verdict instead and drop the flag's plumbing from the tools autogen enum headers. Also factor the pick-side invocation, its follow-up queueing and the post-dispatch checks out of do_pick_task_scx() into dispatch_pick(). No functional changes intended. v2: Drop the SCX_RQ_BAL_KEEP plumbing from the tools autogen enum headers as well (Andrea). Fixes: 4c95380701f5 ("sched/ext: Fold balance_scx() into pick_task_scx()") Cc: stable@vger.kernel.org # v6.19+ Signed-off-by: Tejun Heo <tj@kernel.org>